T09 · Insecure Skill Coding Practices
- Location
scripts/video_processor.py:176- Finding
Predictable Temporary File Enables Symlink Overwrite and Race Conditions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/video_processor.py, lines 176–194
Vulnerability Type: Predictable and insecure temporary-file handling
Risk Level: MediumVulnerable Code:
python # 创建临时文件列表 list_file = 'temp_video_list.txt' with open(list_file, 'w') as f: for path in input_paths: f.write(f"file '{os.path.abspath(path)}'\n") args = [ '-f', 'concat', '-safe', '0', '-i', list_file, '-c', 'copy', '-y', output_path ] returncode, stdout, stderr = self._run_ffmpeg(args) os.remove(list_file)Technical Analysis
merge_videos()creates its FFmpeg concat list under the fixed nametemp_video_list.txtin the process's current working directory. The file is opened with write-and-truncate mode, and Python's normalopen()behavior follows symbolic links.If the working directory is writable by another local user or process, an attacker can create
temp_video_list.txtas a symbolic link to another file writable by the victim. Opening the predictable path then truncates and writes to the symlink target with the privileges of the media-processing process.The fixed filename also creates a time-of-check/time-of-use and concurrency problem. Multiple merge operations running in the same directory can overwrite, consume, or delete each other's concat lists. In addition, cleanup is not placed in a
finallyblock. Exceptions from FFmpeg invocation or file deletion may leave the temporary file and its input-path contents behind.Attack Path
- The attacker identifies a shared or attacker-writable directory from which the application invokes
merge_videos(). - The attacker creates a symbolic link named
temp_video_list.txtpointing to a file that the victim process can write. - The victim invokes
merge_videos(). open(list_file, 'w')follows the symbolic link and truncates the target file.- The method writes attacker ...[truncated 956 chars]
- The attacker identifies a shared or attacker-writable directory from which the application invokes
- Remediation
View remediation
Remediation Suggestions
- Replace the fixed filename with
tempfile.NamedTemporaryFile()ortempfile.mkstemp(), which creates a unique file atomically. - Create temporary files in a trusted directory that is not writable by untrusted users.
- Apply restrictive permissions and avoid reopening a generated path in a way that reintroduces a race.
- Place cleanup in a
finallyblock so the temporary file is removed even when FFmpeg fails. - Escape concat-demuxer path syntax correctly, especially apostrophes and newline characters in input filenames.
- Consider avoiding an intermediate list file where practical.
Example hardening pattern:
python import tempfile list_file = None try: with tempfile.NamedTemporaryFile( mode='w', encoding='utf-8', prefix='video_concat_', suffix='.txt', delete=False ) as f: list_file = f.name for path in input_paths: absolute_path = os.path.abspath(path) escaped_path = absolute_path.replace("'", r"'\''") f.write(f"file '{escaped_path}'\n") args = [ '-f', 'concat', '-safe', '0', '-i', list_file, '-c', 'copy', '-y', output_path ] returncode, stdout, stderr = self._run_ffmpeg(args) finally: if list_file: try: os.unlink(list_file) except FileNotFoundError: pass- Replace the fixed filename with